mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-19 21:31:46 +00:00
jubnl
add0b17e04
Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
23 lines
624 B
TypeScript
23 lines
624 B
TypeScript
import { Response } from 'express';
|
|
|
|
const COOKIE_NAME = 'trek_session';
|
|
|
|
function cookieOptions(clear = false) {
|
|
const secure = process.env.NODE_ENV === 'production' || process.env.FORCE_HTTPS === 'true';
|
|
return {
|
|
httpOnly: true,
|
|
secure,
|
|
sameSite: 'strict' as const,
|
|
path: '/',
|
|
...(clear ? {} : { maxAge: 24 * 60 * 60 * 1000 }), // 24h — matches JWT expiry
|
|
};
|
|
}
|
|
|
|
export function setAuthCookie(res: Response, token: string): void {
|
|
res.cookie(COOKIE_NAME, token, cookieOptions());
|
|
}
|
|
|
|
export function clearAuthCookie(res: Response): void {
|
|
res.clearCookie(COOKIE_NAME, cookieOptions(true));
|
|
}
|